e2ebccdd83d84068508d334fb740f204f17166c0892088514369ece47a2b1a3c

Analysis

max time kernel
90s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 08:49

Target

e2ebccdd83d84068508d334fb740f204f17166c0892088514369ece47a2b1a3c.dll
Size

70KB
MD5

5b3b85003a6691cdaa3f180c18444fb6
SHA1

54c66f6e4b496d1a6c33bbe1e9ef2068675900d7
SHA256

e2ebccdd83d84068508d334fb740f204f17166c0892088514369ece47a2b1a3c
SHA512

9a5c950509ae9d7e78dbed25b19dfe5d7fb2d57432a1c190be9dd678fbcf2275b5ceab3c7e27a269bdc4e89251653fe128d608cfbdee897540b55e24e51bdd0b
SSDEEP

1536:n7ZLNPp9pZBMby7tvAg7qJPoO2BwbXtWyZU81sLHhmhQ:7ZpplF7yR95lsDhEQ

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1428	1664	rundll32.exe	82
PID 1664 wrote to memory of 1428	1664	rundll32.exe	82
PID 1664 wrote to memory of 1428	1664	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2ebccdd83d84068508d334fb740f204f17166c0892088514369ece47a2b1a3c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2ebccdd83d84068508d334fb740f204f17166c0892088514369ece47a2b1a3c.dll,#1
  2⤵
  PID:1428